Slashdot Mirror
Indemnity Protection for Linux?
spookymonster asks: "I'm a mainframe sysadmin for a Fortune 50 company. I'm also a Linux hobbyist. About 18 months ago, my request for a proof-of-concept z/Series testbed was granted, and the results have been encouraging. Despite this, senior management keeps saying that Linux isn't ready for prime time. Today, I was finally able to corner one of them and ask him what exactly his issue was with Linux. His answer: Indemnity. All our other software vendors provide protection against someone suing us for using their product. Who protects us if a third party sues us, claiming Linux infringes on their copyrights? Sadly, I was at a loss for words. I've done some digging on Google, but haven't really found anything on the subject. With the SCO/IBM lawsuit heavy in the headlines of late, I figured I'd turn to the Slashdot community for answers. How do I respond to questions about Linux and indemnification protection?"
It's really a good question, and I have no answer
/. is US-centric, but
for you, I'm sorry.
But I want to extend the question on BSD Unix, i.e.
OpenBSD, NetBSD and FreeBSD.
Also I want to remind you that
the world is more than USA. I'm, for example,
under European law.
My Karma isn't excellent, damn it! (And
These aren't good answers, but maybe it start you thinking "outside of the box."
1) Will MSFT really provide this indemnity protection? Do they say they will? If so, has that provision ever been tested? If they don't, or won't, then of course it's not fair to compare apples to oranges.
2) OTOH, you might try 'speciality' insurance companies. I have no idea what the rates would be like, but you can certainly buy insurance to cover any eventuality you can imagine--another poster here once talked about purchasing insurance against the loss of moon rock that they were testing. Which is just to say--just because "Linux insurance" isn't on a regular schedule doesn't mean that some actuarian won't give you a price. If you need to make calls, I would start with "Lloyd's of London", known for providing insurance for unusual events.
Finally, I think your concern is a real one--what's to stop me from using code that I developed elsewhere and contribute it back into the Linux source?
--
$tar -xvf
Tell that to users of MS SQL Server users who are liable to pay royalties to a third party.
What's the practical difference buying from, say, Redhat over buying from MS or Oracle?
"Your OS is writing checks your company can't cash."
Buy it from a vendor.
Perhaps none of them will offer the level of indemnity that you require, but if you ask enough of them, it may convince one of them that this might be a viable business model, and start offering it in the future. Essentially you'll be paying for insurance rather than software, so this would be an interesting new way for making money from open source.
Just look at the the MSSQL ruling posted to slashdot not to long ago. MS left some of their customers out to dry to pay royalty fees to a third party because MS's license didn't allow customers to use it.
Stupid things kids do.
Of coursse, this is at the start of litigation, and no-one knows how it will turn out. But isn't this exactly what your executive is worrying about happening with Open Source software? And this is from the Godzilla of them all, Microsoft.
No-one can make you perfectly safe from such claims - valid or invalid. But with open source, it shoudl be a lot easier to establish the truth of such allegations, because the source is available, and trackable, a long way back. If closed-source supplier A alleges that closed source supplier B has pirated code, you are into heavy calibre lawyers before source gets disclosed under court order. With open source, you go to the CVS tree, check earliest versions, check dates.... False claims should be seen off pretty quicly. And someone filing proprietary code as OS would be pretty visible (and spurned) within the community.
And if it turns out that you have been using some stolen code, with OS you at least have the option of throwing out only the stolen bits and rewriting them, whereas with closed source you are dependant upon your supplier doing that for you - if the lawsuit hasn't destroyed them, which it would do for a small company (and then where is your indemnity? At then end of the trail of unsecured creditors, I should think).
To summarise: such situations are much less likely to occur with Open rather than Closed source. If they do occur, that indemnity has a good chance of being waste paper. Meanwhile, you have paid out *a lot* in licence fees for a very threadbare security blanket.
Consciousness is an illusion caused by an excess of self consciousness.
But i had to look up what Indemnity means. I myself am curious as to what companies will pay for damages for using their software. It would be nice to see Microsoft pay for the billions of dollars of damage there software causes on the internet due to worms and the sort.
"I believe in everything in moderation. Including moderation." -Dean DeLeo, Stone Temple Pilots
Not to trash the questioner, but if you work for a Fortune 50 company, surely your in-house legal department would have some idea, no? As another poster suggested, Red Hat or IBM will definitely provide this: I'm sure that RH's announcement yesterday of Advanced Server revisions is pertinent (though not directly to do with indemnity issues) to you on some level.
You're an admin guy, you know Unix. The legal people know the law. Ask them to look into it, and cc the manager you talked to so that both sides know you want this examined seriously.
========================================
Death will come, and will have your eyes
-- Pavese
All our other software vendors provide protection against someone suing us for using their product.
You mean someone can sue you because you are using a program that infringed a law, but you weren't aware of? Or would you be aware, ie: The software producer would inform you that his product infringes a law?
I didn't get. Is this possible? I am not from USA (if you are), so things might be different there.
But wouldn't this be like RIAA suing listeners of a radio that plays "pirated" music? Or BSA suing players of a LAN house over "pirated" Half-Life copies?
Just want some clarification of why, and how, this is possible...
Buy a Nintendo DS Lite
Sounds like he was just looking for a pretext.
All our other software vendors provide protection against someone suing us for using their product.
If anybody indemnifies anybody, it's usually the other way around. At least all the Microsoft EULAs I have seen say something like
(this one is taken from here).In general, I think anybody who offers a Fortune 50 company protection from lawsuits is a fool or speculating that they'd go bankrupt anyway if that should ever come to court (and you would still get sued).
I also doubt this kind of indemnity would be useful for Linux even if someone offered it. I mean, how often has this come up over the last decade? These kinds of lawsuits seem like such a rare occurrence when it comes to open source software that it just doesn't seem worth worrying about.
Open Source Vender 2: No I'm not, but if you think I am bring your code, I'll bring mine and we'll discuss it at the pub
(Many hard drinks later)
Open Source Vender 1: Fusking M$ and closed source is killing the world man.
Open Source Vender 2: Fusking eh, down with M$...Now what the hell were we arguing about?
It take more faith to believe in evolution than it takes to believe in God
It would be interesting to see how RedHat is going to provide security to me. The original poster was talking about enterprise level Z/OS machines, not a farm of x86 boxen. The world doesn't revolve around the hordes of college geeks and the ubber fast 'leete machines they run. Your bank can't afford to be caught with their pants down, and that is why they go with the IBM flavor of Linux, which is bastardization of SUSE. But, for all who care, IBM offers the exact protection the original poster is requesting. I know, cause there is a Z/OS mainframe box on this floor that we run linux on it. While this one isn't in a development role, the shrink wrap wouldn't have made it into the building without our in-house legal department's approval first.
Show them the software license, specifically section seven which may or may not apply, and sections 11 and 12 which do apply:
Section 7 (in part): If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License.
Section 11 (all): BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
Section 12 (all): IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
So the straight answer is that the word indemnification does not occur in the license. Whether the license has no, little, or good indemnification should be judged by a lawyer. It seems as though the GPL protects those who wrote, modified, and distributed the programs in question from those who use the program, but doesn't seem to extend any special protections to those who use the program from their customers or other third parties.
My limited understanding of indemnity is that it's usually in a contract between a software supplier and a client, and the supplier usually carries insurance to cover indemnity claims. Thus, for Linux to have indemnity you'd have to contract to, say redhat, for the software and set up a clause in the contract specifically covering this issue.
-Adam
"I'm not a lawyer, but I play one on slashdot..."
Your chances of getting sued for using Linux are
considerably less than your chances of getting hit
by a meteor while skydiving naked. (Which you are
also not insured for.)
Get back to us when you're back from the laughing
academy.
-I like my women like I like my tea: green-
OK, your management isn't hot on linux because they can't sue anybody if it doesn't work. I'm not familiar with VM/ESA's licensing agreements, but I can't name a single vendor that produces a product that their licensing claims is useful for anything, or that will indemnify if the software is a complete piece of crap. Nothing else in the US can be sold with the same disclaimers against liability as software because of the Consumer Protection Act. You can sue the vendor if you buy a lamp that has a defect that causes your house to burn down. You can't sue your vendor if their software loses data, infringes on someone else's patents and you get pulled into a liability suit, or their OS can't stay up for more than a week without hard-crashing.
Now, I'm going to go out on a limb here and guess that you're in a shop that already has at least one z390 available, or that your company has a lot of cash to burn. The reason I am inclined to this opinion is that a nice, shiny new z390 costs about $50K USD. Having a partition added to an existing z390 costs more than my car and my wife's car put together. In either case, there is still a real cost per cycle of computing on that platform that even a PHB can see. Find out what IBM is providing license wise under VM/ESA that they don't provide under their licensing agreement with RedHat. Then study the costs of the migration to linux. since any mainframe OS has monthly licensing costs (last I checked, which I will concede was more than a couple of years ago), long-term migration to OSS on the OS side will eventually come out on top dollar for dollar. It also can't hurt to point out that IBM seems to have concluded that linux is the direction for all of their server-class and mainframe machines in the long term.
As an aside, for those of you reminding this guy about the MS SQL 7/2k licensing issues, this case has been in court for about 3 years, and everybody who is about to get hosed on patent licensing was told by MS's PR dept. that they didn't have a thing to worry about. Part of what the customers are getting nailed to the wall on is the > 2 1/2 years that patent licensing has been a known issue where they didn't talk to the patent owners and acquire the appropriate licensing for their copy of MSSQL. In any case, the indemnification argument could work incredibly well as an argument to move away from MS on the smaller servers, but you are going to have to do some homework to get anything done about the mainframes.
Few people, even business directors, have the legal knowledge to understand licensing issues. It sounds like this guy is just trying to throw out legal jargon so that you cannot argue the points technically. It is an avoidance technique.
Check out the story on The Register that everyone keeps mentioning, and you'll see a clearer example of what I mean. According to the story, Timeline may be able to demand license payments from Microsoft SQL server customers. A Washington court stated that the fact that Microsoft told customers they didn't need any additional licensing didn't remove the customer's obligation for due dilligence. This is all under the terms of Microsoft's standard licensing agreements; no mention is made of what would happen to customers that had separate indemnity contracts.
If anything, this article supports the argument that separate indemnity contracts are crucial when making large investments in other people's code.
- Despite popular opinion, I am not perfect.
Gonna have to post this one anonymously! And perhaps I will obfusticate the name of a large software and hardware company....
Our business was about to fold because HAL sold us wares that simply did not do what they promised us it would.
HAL's attitude was "oh well, sorry about that!"
So, the biggest weasel PHB in the company got an HAL big wheel on the phone, and after about a half an hour got said big wheel to ADMIT that HAL had knowingly sold us software that was broken and could not do what they said it would do.
Then, weasel-boy took the SECRET TAPE RECORDING he'd made of that conversation, which mentions dates, places, products, test results, etc. and duplicated it a half-dozen or so times. He sent one copy to HAL and escrowed the rest in various places.
HAL bought back all our stuff at the cost we paid for it AND gave us a $4 million mainframe installation, and all the incriminating tapes were destroyed.
They weren't worried about the legal issues. Your lawyer is full of shit, no software company is legally liable for your losses under any circumstances (barring outright egregious and repeated fraud, and maybe not even then - we'll see how the MS-SQL case works out).
What they were worried about was the PR that we were going to generate when we published transcripts in the New York Times. Sure, they'd sue us and win, but so what - the company'd be out of business anyway.
Sometimes even weasel PHBs have their uses!
...good luck to the suers chasing down and confronting a zillion individual MS SQL users.
:)
Hard? All they'd have to do is attach an invoice to some Slammer code and voila!
- Despite popular opinion, I am not perfect.